Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 
 

Example: Configuring a Physical Interface Policer for Aggregate Traffic at a Physical Interface

This example shows how to configure a single-rate two-color policer as a physical interface policer.

Requirements

No special configuration beyond device initialization is required before configuring this example.

Overview

A physical interface policer specifies rate-limiting for aggregate traffic, which encompasses all protocol families and logical interfaces configured on a physical interface, even if the interfaces belong to different routing instances.

You can apply a physical interface policer to Layer 3 input or output traffic only by referencing the policer from a stateless firewall filter that is configured for specific a specific protocol family (not for family any) and configured as a physical interface filter. You configure the filter terms with match conditions that select the types of packets you want to rate-limit, and you specify the physical interface policer as the action to apply to matched packets.

Topology

The physical interface policer in this example, shared-policer-A, rate-limits to 10,000,000 bps and permits a maximum burst of traffic of 500,000 bytes. You configure the policer to discard packets in nonconforming flows, but you could instead configure the policer to re-mark nonconforming traffic with a forwarding class, a packet loss priority (PLP) level, or both.

To be able to use the policer to rate-limit IPv4 traffic, you reference the policer from an IPv4 physical interface filter. For this example, you configure the filter to pass the policer IPv4 packets that meet either of the following match terms:

  • Packets received through TCP and with the IP precedence fields critical-ecp (0xa0), immediate (0x40), or priority (0x20)

  • Packets received through TCP and with the IP precedence fields internet-control (0xc0) or routine (0x00)

You could also reference the policer from physical interface filters for other protocol families.

Configuration

The following example requires you to navigate various levels in the configuration hierarchy. For information about navigating the CLI, see Using the CLI Editor in Configuration Mode.

To configure this example, perform the following tasks:

CLI Quick Configuration

To quickly configure this example, copy the following configuration commands into a text file, remove any line breaks, and then paste the commands into the CLI at the [edit] hierarchy level.

Configuring the Logical Interfaces on the Physical Interface

Step-by-Step Procedure

To configure the logical interfaces on the physical interface:

  1. Enable configuration of logical interfaces.

  2. Configure protocol families on logical unit 0.

  3. Configure protocol families on logical unit 1.

Results

Confirm the configuration of the firewall filter by entering the show interfaces configuration mode command. If the command output does not display the intended configuration, repeat the instructions in this procedure to correct the configuration.

Configuring a Physical Interface Policer

Step-by-Step Procedure

To configure a physical interface policer:

  1. Enable configuration of the two-color policer.

  2. Configure the type of two-color policer.

  3. Configure the traffic limits and the action for packets in a nonconforming traffic flow.

    For a physical interface filter, the actions you can configure for packets in a nonconforming traffic flow are to discard the packets, assign a forwarding class, assign a PLP value, or assign both a forwarding class and a PLP value.

Results

Confirm the configuration of the policer by entering the show firewall configuration mode command. If the command output does not display the intended configuration, repeat the instructions in this procedure to correct the configuration.

Configuring an IPv4 Physical Interface Filter

Step-by-Step Procedure

To configure a physical interface policer as the action for terms in an IPv4 physical interface policer:

  1. Configure a standard stateless firewall filter under a specific protocol family.

    You cannot configure a physical interface firewall filter for family any.

  2. Configure the filter as a physical interface filter so that you can apply the physical interface policer as an action.

  3. Configure the first term to match IPv4 packets received through TCP with the IP precedence fields critical-ecp, immediate, or priority and to apply the physical interface policer as a filter action.

  4. Configure the first term to match IPv4 packets received through TCP with the IP precedence fields internet-control or routine and to apply the physical interface policer as a filter action.

Results

Confirm the configuration of the firewall filter by entering the show firewall configuration mode command. If the command output does not display the intended configuration, repeat the instructions in this procedure to correct the configuration.

Applying the IPv4 Physical interface Filter to Reference the Physical Interface Policers

Step-by-Step Procedure

To apply the physical interface filter so it references the physical interface policers:

  1. Enable configuration of IPv4 on the logical interface.

  2. Apply the IPv4 physical interface filter in the input direction.

Results

Confirm the configuration of the firewall filter by entering the show interfaces configuration mode command. If the command output does not display the intended configuration, repeat the instructions in this procedure to correct the configuration.

If you are done configuring the device, enter commit from configuration mode.

Verification

Confirm that the configuration is working properly.

Displaying the Firewall Filters Applied to an Interface

Purpose

Verify that the firewall filter ipv4-filter is applied to the IPv4 input traffic at logical interface so-1/0/0.0.

Action

Use the show interfaces statistics operational mode command for logical interface so-1/0/0.0, and include the detail option. In the Protocol inet section of the command output, the Input Filters field shows that the firewall filter ipv4-filter is applied in the input direction.

Displaying the Number of Packets Processed by the Policer at the Logical Interface

Purpose

Verify the traffic flow through the logical interface and that the policer is evaluated when packets are received on the logical interface.

Action

Use the show firewall operational mode command for the filter you applied to the logical interface.

The command output displays the name of policer (shared-policer-A), the name of the filter term (police-1) under which the policer action is specified, and the number of packets that matched the filter term. This is only the number of out-of-specification (out-of-spec) packet counts, not all packets policed by the policer.